OSHA Bloodborne Pathogens 29 CFR 1910.1030: Plan, PPE, and Training

Under the OSHA bloodborne pathogens standard at 29 CFR 1910.1030, employer requirements include a written Exposure Control Plan, engineering and work practice controls, free personal protective equipment, free hepatitis B vaccination, confidential post-exposure medical evaluation, annual training, and specific recordkeeping — for every worker whose job creates reasonably anticipated contact with blood or other potentially infectious materials. Falling short currently exposes you to penalties up to $16,550 per serious violation and $165,514 per willful or repeated violation, adjusted upward each January.¹

Does the Standard Apply to Your Workplace

The trigger is the nature of the work, not the industry label. “Occupational exposure” means reasonably anticipated contact with blood or other potentially infectious materials (OPIM) through skin, eyes, mucous membranes, or a skin-piercing event, arising from job duties.²

Hospitals, clinics, emergency response, and laboratories are the obvious cases. The standard also reaches tattoo and body-piercing studios, funeral homes and mortuaries, correctional facilities, drug treatment centers, facilities for people with developmental disabilities, hospices, nursing homes, and commercial laundries that process clinical linens.³ Janitorial and maintenance staff in any of these settings are covered because their cleaning duties bring them into contact with biological waste.

One boundary trips employers up. The standard does not cover workers who provide first aid or CPR purely on a voluntary, unplanned basis when their job description includes no medical duties. But the moment you formally designate someone as a first-aid responder or emergency medical provider, that person has occupational exposure and must be folded into the full compliance program.² Evaluate every position, not just titles with “nurse” or “technician” in them.

About half the states run their own OSHA-approved workplace safety programs. If you operate in a State Plan state, that agency enforces the bloodborne-pathogen rules; the core requirements mirror or exceed the federal version.⁴

What Counts as Blood or OPIM

“Other potentially infectious materials” is defined broadly. It includes semen and vaginal secretions; cerebrospinal, synovial, pleural, pericardial, peritoneal, and amniotic fluid; saliva during dental procedures; any body fluid visibly contaminated with blood; and all body fluids when you can’t tell which type you’re dealing with. It also covers any unfixed human tissue or organ other than intact skin, HIV- or hepatitis B-containing cell cultures and solutions, and blood or tissue from lab animals infected with HIV or HBV.² The practical rule: when you’re uncertain, treat the fluid as infectious.

Writing and Maintaining the Exposure Control Plan

Every covered employer must create and maintain a written Exposure Control Plan designed to eliminate or reduce exposure.² A copy must be accessible to every employee during their work shift, whether in a physical binder or through digital access.

The plan’s core is the Exposure Determination: a catalog of every job classification where employees face occupational exposure, built without considering PPE. The question is whether the task itself creates a reasonable chance of contact, not whether gloves would prevent it. For each listed position, the plan must identify the specific tasks and procedures where blood or OPIM exposure is likely, such as drawing blood, handling regulated waste, or cleaning treatment rooms.²

Review and update the plan at least annually, and sooner if job duties or procedures change. Each annual review must document your consideration of newer, safer medical devices available on the market.² A rubber-stamp review won’t hold up; you need to show you actually looked at what’s commercially available and decided whether to adopt it.

You must also solicit input from non-managerial employees who use sharps devices when selecting and evaluating engineering controls. That input has to be documented in the plan, and OSHA checks for it during inspections.⁵

Controls You Must Put in Place

The standard uses a layered approach, and the order matters. Engineering and work practice controls come first; PPE is the backup.

Universal Precautions

Treat all human blood and body fluids as if they are known to be infectious.² This foundational rule eliminates the guesswork that leads to shortcuts.

Engineering and Work Practice Controls

Engineering controls physically isolate or remove the hazard: puncture-resistant sharps disposal containers, self-sheathing needles, and other safer medical devices with built-in sharps-injury protection.² Used sharps go into appropriate containers immediately or as soon as feasible after use.

Work practice controls change how a task is performed. Employees may not recap needles using a two-handed technique, and breaking or shearing contaminated needles is flatly prohibited.²

PPE and Handwashing

When engineering and work practice controls can’t eliminate exposure on their own, provide appropriate PPE at no cost. That typically means gloves, gowns, face shields, eye protection, and masks or respirators depending on the task. You are responsible for making sure the equipment is accessible, in the right sizes, and replaced when damaged or contaminated.

Employees must wash their hands immediately or as soon as feasible after removing gloves or other PPE.² When soap and running water aren’t available, you must provide antiseptic hand cleanser with clean cloth or paper towels, followed by soap-and-water washing as soon as practicable.

Labels, Waste, Laundry, and Housekeeping

Biohazard warning labels must be fluorescent orange or orange-red with contrasting lettering and the universal biohazard symbol. They go on containers of regulated waste, refrigerators and freezers storing blood or OPIM, and any other container used to store, transport, or ship infectious materials. Contaminated equipment needs a label identifying which parts remain contaminated.⁶

Some practical exemptions apply. Red bags or red containers substitute for biohazard labels entirely.⁷ Individual containers already placed inside a labeled outer container don’t need their own separate labels. Blood products labeled for transfusion or clinical use are exempt. Fully decontaminated regulated waste no longer needs labeling.⁶

Contaminated Laundry

Contaminated laundry must be handled as little as possible and never sorted or rinsed at its point of use. Bag it at that point in labeled or color-coded containers. If it’s wet enough that fluids could soak through, use a leak-proof container. Employees handling contaminated laundry must wear gloves and any other PPE the situation requires.²

If you ship contaminated laundry off-site to a service that does not use Universal Precautions for all laundry, those shipments need standard biohazard markings. If both facilities treat all soiled laundry under Universal Precautions, alternative color-coding that employees recognize is acceptable.⁷

Housekeeping and Decontamination

Establish a written cleaning and decontamination schedule tailored to the worksite. The schedule takes into account location within the facility, type of surface, type of contamination present, and procedures performed in the area.² A phlebotomy station and a general office hallway need different frequencies and methods.

Use products from the EPA’s “List S,” which registers antimicrobial products tested and approved for effectiveness against HIV, hepatitis B, and hepatitis C. Contact time on the product label is critical: the surface must stay wet for that full duration to kill the target pathogen, and contact times can differ for each pathogen even on the same label.⁸

Free Hepatitis B Vaccination

Offer the hepatitis B vaccination series to every employee with occupational exposure, at no cost, within 10 working days of initial assignment. It must be administered by or under the supervision of a licensed healthcare professional, and the timing and location must be reasonable for the employee. The only exceptions: employees who have already completed the series, who have tested immune through antibody testing, or for whom the vaccine is medically contraindicated.⁹

Employees can decline, but a verbal “no” is not enough. The worker must sign a declination form using the specific language prescribed in Appendix A of the standard. An employee who initially declines can change their mind later, and you must make the vaccine available at that point at no cost.⁹

Post-Exposure Evaluation and Follow-Up

An “exposure incident” is a specific contact event: blood or OPIM gets into an employee’s eyes, mouth, other mucous membrane, non-intact skin, or through a needlestick or other skin-piercing injury during the course of duties. When one happens, make a confidential medical evaluation and follow-up available immediately, at no cost, performed by or under the supervision of a licensed physician or healthcare professional.²

The post-exposure protocol includes several required steps:

Document the route of exposure and the circumstances of the incident.
Identify and test the source individual’s blood for HIV and hepatitis B, as soon as feasible after obtaining consent or as permitted by law.
Collect and test the exposed employee’s blood for HIV and hepatitis B status.
Provide post-exposure preventive treatment when medically indicated, following U.S. Public Health Service recommendations.
Provide counseling about the exposure and its implications.

You must also give the evaluating healthcare professional a copy of the standard, a description of the employee’s duties as they relate to the incident, details of how the exposure occurred, the source individual’s test results if available, and the employee’s relevant medical records including vaccination status.²

Within 15 days after the evaluation is complete, obtain and give the employee a copy of the healthcare professional’s written opinion. The standard limits what that opinion can say: only that the employee has been informed of the evaluation results and told about any medical conditions from the exposure that need further evaluation or treatment. All other findings and diagnoses must remain confidential and stay out of the written report sent to you.⁶ You learn what you need for compliance without gaining access to the employee’s full medical picture.

Training You Must Provide

Train every employee with occupational exposure at the time of initial assignment and at least once a year afterward.¹⁰ The training must cover how bloodborne diseases are transmitted, the details of your Exposure Control Plan, how to recognize tasks that involve exposure, and the proper use of engineering controls and PPE. Employees must have the opportunity to ask questions of the trainer during the session, so a purely passive video with no live instructor doesn’t satisfy the requirement on its own.

Repeat training whenever an employee moves to a new position or takes on new tasks that create different exposure risks. Annual refreshers must cover any changes to the plan, new procedures, or new devices adopted since the last training.

Records You Must Keep

The standard imposes three separate recordkeeping obligations, each with different retention rules.

Maintain a confidential medical record for each employee with occupational exposure, including name, Social Security number, hepatitis B vaccination status, and results of any post-exposure evaluations. Keep it for the duration of employment plus 30 years. Medical records cannot be disclosed without the employee’s express written consent, except as required by law.²

Keep records of each training session for three years from the date of the session. Each record must include training dates, a summary of the content covered, the trainer’s name and qualifications, and the names and job titles of all attendees.²

Maintain a Sharps Injury Log documenting each incident involving a contaminated sharp. The log captures the type and brand of device involved, the department or work area where the injury occurred, and a description of how the incident happened. Maintain the log in a way that protects the confidentiality of the injured employee.²

What Noncompliance Costs

OSHA adjusts penalty maximums annually for inflation. As of the adjustment effective January 15, 2025, a serious violation of the bloodborne pathogens standard carries a maximum penalty of $16,550 per violation. Willful or repeated violations can reach $165,514 per violation.¹ Those are ceilings. Actual penalties depend on employer size, the gravity of the violation, good-faith efforts, and compliance history. A single inspection that uncovers multiple violations across several requirements can produce a combined penalty well into six figures, particularly for willful failures like having no Exposure Control Plan at all.

1
Occupational Safety and Health Administration. OSHA Penalties
2
Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens
3
Occupational Safety and Health Administration. Applicability of the Bloodborne Pathogens Standard to the Tattoo and Body Piercing Industries
4
Occupational Safety and Health Administration. Bloodborne Pathogens – Standards
5
Occupational Safety and Health Administration. Standard Interpretations – Employers Responsibility to Re-Evaluate Engineering Controls
6
eCFR. 29 CFR 1910.1030 – Bloodborne Pathogens
7
Occupational Safety and Health Administration. Unintended Disposal of Blood-Contaminated Hospital Linens by Laundries
8
United States Environmental Protection Agency. EPAs Registered Antimicrobial Products Effective Against Bloodborne Pathogens – List S
9
Occupational Safety and Health Administration. Hepatitis B Vaccination Protection
10
Occupational Safety and Health Administration. Standard Interpretations – 1993-02-02 – Bloodborne Pathogens Standard